Bluesky Verification: Set Your Custom Domain Handle

Bluesky verification, in its original and most powerful form, means setting a domain you own as your account handle — so instead of @yourbrand.bsky.social you appear as @yourbrand.com. It is a self-serve credibility signal unique to Bluesky: the network confirms you control the domain, and every reader instantly sees that the account belongs to the real website behind the brand.

This is different from the blue checkmark. Bluesky later added an official verification badge program run through trusted verifiers, but the domain handle is the foundational, free, do-it-yourself trust signal — and for most brands it is the one that actually matters. If you run a business, this is the single highest-leverage thing you can do on the platform. Here is exactly how it works and how to set it up.

Why domain handles exist on Bluesky

Bluesky is built on the AT Protocol, an open system where your identity is portable and tied to a cryptographic identifier called a DID (decentralized identifier). When you sign up, Bluesky gives you a default .bsky.social handle for free. That handle is just a human-readable pointer to your DID.

Because the protocol lets any domain point to a DID, Bluesky made a clever decision: your handle can be any domain you control. The New York Times posts as @nytimes.com. A journalist can be @jane.substack-domain.com. A small business can be @yourshop.com. Anyone visiting the profile sees the domain in the handle itself, which is far harder to fake than a display name.

That is the whole trick. There is no application, no waiting queue, no fee. If you can edit your domain's DNS records or upload a file to your website, you can verify yourself in minutes.

Domain handle vs. the blue checkmark

Do not confuse the two systems, because they solve different problems:

• Domain handle verification — free, self-serve, proves you control a specific website. Available to everyone. This is what this guide covers.
• The blue verification badge — issued by Bluesky itself and a set of trusted organizations (news outlets, institutions) that can vouch for accounts. You cannot simply buy or request it the way you set a domain handle; it is granted.

For the vast majority of brands, creators, and businesses, the domain handle is your verification. It answers the only question your audience really has: "Is this actually them?" A domain you obviously own answers that immediately. Chasing the blue check is usually a distraction — set your domain handle first.

What you need before you start

Gather three things:

1. A domain you control — your main site (yourbrand.com) or a subdomain (social.yourbrand.com, news.yourbrand.com). Subdomains are perfectly valid and let you keep your root domain untouched.
2. Access to your DNS settings — through your registrar or DNS host (Cloudflare, Namecheap, GoDaddy, Google Domains, and so on). This is the recommended method.
3. Your Bluesky DID — you will copy this out of the app during setup. It looks like did:plc: followed by a string of characters.

If you do not have DNS access but you can upload files to your website, there is a second method (the well-known file) covered below.

Method 1: DNS verification (recommended)

This is the cleanest approach and the one Bluesky nudges you toward. The steps:

1. In the Bluesky app, go to Settings → Account → Handle.
2. Tap "I have my own domain" (or "Change handle").
3. Enter the domain you want to use, for example yourbrand.com.
4. Choose the DNS option. Bluesky will show you two values: a host/name (_atproto) and a TXT record value that contains your DID (did=did:plc:...).
5. In your DNS host, create a new TXT record:
   • Name / host: _atproto (if you are verifying the root domain) or _atproto.social (if your handle is social.yourbrand.com).
   • Value: the exact string Bluesky gave you, starting with did=.
6. Save the record, wait for DNS to propagate (often a few minutes, sometimes up to an hour), then return to Bluesky and tap Verify.

Once it verifies, your handle updates across the network. A few practical notes that save headaches:

• The record goes on _atproto as a subdomain of the handle you want, not your root domain, unless the handle is the root. For news.yourbrand.com, the TXT record host is _atproto.news.
• Do not wrap the value in extra quotes beyond what your DNS panel adds automatically.
• If verification fails, propagation is the usual culprit. Wait and retry before assuming the record is wrong.

Method 2: The well-known file (no DNS access)

If you cannot touch DNS but you can publish files to your site, use the HTTP method:

1. In the same handle screen, choose the "No DNS Panel" option.
2. Bluesky gives you your DID string.
3. Create a plain text file containing only that DID (did:plc:..., nothing else — no line breaks, no extra text).
4. Host it at exactly this path: https://yourdomain.com/.well-known/atproto-did
5. Confirm it loads in a browser and returns just the DID, then tap Verify in Bluesky.

This method works well for brands on platforms like Webflow, Ghost, or a static site where you control the file structure but DNS is managed elsewhere. The file must be served over HTTPS and return the raw DID as plain text — if your CMS wraps it in HTML, verification will fail.

After you verify: what changes and what does not

Your handle becomes the domain. Old links and mentions to your .bsky.social handle typically still resolve because the underlying DID never changed — the handle is just a friendlier label on top of it. That portability is the point of the decentralized model.

A few things worth knowing:

• You can change it again later. Your identity lives at the DID level, so switching handles does not reset your account, followers, or posts.
• Keep the record in place. If you delete the TXT record or the well-known file, Bluesky can eventually revert you to a .bsky.social handle. Treat it as permanent infrastructure, not a one-time step.
• Match it to your other profiles. Consistent handles across networks reinforce the trust signal. When your Bluesky handle is your website, it lines up naturally with the domain in your bio everywhere else.

Should a brand use the root domain or a subdomain?

Both work; the choice is about tidiness.

• Root domain (yourbrand.com) — strongest, cleanest signal. Best when the account is the official voice of the company. Requires one _atproto TXT record at the root.
• Subdomain (social.yourbrand.com) — keeps your main domain's DNS untouched and is ideal when different teams or people each want a verified handle under the same brand. A support account could be @help.yourbrand.com, a founder @dan.yourbrand.com.

For multi-person teams, subdomains are underrated: they let everyone carry the brand domain in their handle while staying clearly distinct. That is a credibility pattern no centralized network can replicate.

Make Bluesky part of your actual posting habit

Verification is a one-time setup. The trust it earns only compounds if you actually show up on the platform. This is where most brands stall — they claim the handle, post twice, and drift back to the networks they already run daily.

The fix is to fold Bluesky into the same workflow as everything else. With SocialKit you can schedule, customize, and analyze posts across all 11 platforms — including Bluesky, Mastodon, and the rest of the fediverse-adjacent networks — from one calendar, so a freshly verified handle does not go quiet. Post natively for Bluesky's text-first culture while keeping your Instagram, LinkedIn, and X queues moving in the same view. If you want the platform primer alongside the setup, our Bluesky overview covers where it fits in a broader mix, and the wider blog has deeper strategy guides once you are established.

Quick troubleshooting checklist

If verification will not complete, walk through these in order:

• Wrong host on the TXT record. It must be _atproto prefixed to the exact handle you are claiming — not your bare root domain when you are verifying a subdomain.
• DNS has not propagated. Give it more time; propagation is not instant.
• Extra characters in the value. The DNS value should start with did= and the well-known file should contain only the DID.
• The file is not plain text. A CMS wrapping your DID in HTML will break the well-known method.
• HTTP instead of HTTPS. The well-known file must be served securely.

Set the domain handle once, keep the record in place, and you have a verification signal that costs nothing, cannot be faked, and travels with your identity for as long as you own the domain. For a small brand, that is the best-value credibility move on any network right now — and the only one where your website itself does the vouching.

Ready to keep a verified Bluesky handle active without the daily grind? Start a free 7-day trial and schedule your first week of posts across every platform from one place.